File block - Can't upload .zip file using Upload button but can using Media Library link

[bobbingwide]

Describe the bug
In my site oik-plugins.com I support the uploading of .zip files - downloadable plugins and themes.
For a long time now I've not been able to upload .zip files directly using the Media button of the File block.
I get the message: Sorry, this file type is not permitted for security reasons.
The workaround is to use the Media Library button and upload the file that way.

Q. What do I need to do to enable the upload directly?

To reproduce
Steps to reproduce the behavior:

1. First of all configure your system to allow .zip files to be uploaded.
2. Add a new post
3. Add the File block
4. Click Upload
5. Choose a .zip file
6. See the message
7. Click Media Library
8. Choose the file again
9. Upload it successfully.

Expected behavior
.zip file should be accepted using the Upload button.

Updated to reflect my comments from July 1st.

• The problem occurs in Windows: the File block exposes a core bug with mime types.
• See https://core.trac.wordpress.org/ticket/40175 and https://core.trac.wordpress.org/ticket/46775
• In my opinion the most sensible fix would be in WordPress core.
• It's also possible that Gutenberg could be changed to allow the upload to proceed for any mediaFile.type that it doesn't recognise and rely on the server being responsible for rejecting it.

Screenshots
If applicable, add screenshots to help explain your problem.

Editor version (please complete the following information):

• WordPress version: [e.g: 5.3.2] 5.4.2
• Does the website has Gutenberg plugin installed, or is it using the block editor that comes by default? [e.g: "gutenberg plugin", "default"] 8.3.0
• If the Gutenberg plugin is installed, which version is it? [e.g., 7.6] 8.3.0

Desktop (please complete the following information):

• OS: [e.g. iOS] Windows
• Browser [e.g. chrome, safari] Chrome
• Version [e.g. 22] Version 83.0.4103.116 (

Additional context

• To report a security issue, please visit the WordPress HackerOne program: https://hackerone.com/wordpress.

[annezazu]

@bobbingwide Hey there! Thanks for reporting this. I tried to replicate on my end using Gutenberg 8.4.0, WordPress 5.4.2, and the TwentyTwenty theme. Here's a video where I used a zip of a previous Gutenberg version as a test with the file block:

https://cloudup.com/cL1oapNsrcS

Generally speaking, this is likely related to other security measures on your site and not Gutenberg. For example, here's a guide that walks you through how to resolve this: https://www.elegantthemes.com/blog/wordpress/how-to-fix-the-sorry-this-file-type-is-not-permitted-for-security-reasons-error-in-wordpress

If you believe this is Gutenberg specific though, please do re-open this issue! For now, I'm going to close this out.

[bobbingwide]

I'm running the code locally in my Windows development environment.
When I view source the value of _wpUploadSettings is:

var _wpPluploadSettings = {"defaults":{"file_data_name":"async-upload","url":"/wp54/wp-admin/async-upload.php","filters":{"max_file_size":"26214400b","mime_types":[{"extensions":"jpg,jpeg,jpe,gif,png,bmp,tiff,tif,ico,asf,asx,wmv,wmx,wm,avi,divx,flv,mov,qt,mpeg,mpg,mpe,mp4,m4v,ogv,webm,mkv,3gp,3gpp,3g2,3gp2,txt,asc,c,cc,h,srt,csv,tsv,ics,rtx,css,htm,html,vtt,dfxp,mp3,m4a,m4b,aac,ra,ram,wav,ogg,oga,flac,mid,midi,wma,wax,mka,rtf,js,pdf,class,tar,zip,gz,gzip,rar,7z,psd,xcf,doc,pot,pps,ppt,wri,xla,xls,xlt,xlw,mdb,mpp,docx,docm,dotx,dotm,xlsx,xlsm,xlsb,xltx,xltm,xlam,pptx,pptm,ppsx,ppsm,potx,potm,ppam,sldx,sldm,onetoc,onetoc2,onetmp,onepkg,oxps,xps,odt,odp,ods,odg,odc,odb,odf,wp,wpd,key,numbers,pages"}]},"multipart_params":{"action":"upload-attachment","_wpnonce":"b46a1bd832"}},"browser":{"mobile":false,"supported":true},"limitExceeded":false};

as you can see zip is listed in the file types.

I don't see any request going to the server.
So the validation is being performed in Gutenberg, or when Gutenberg is not active, WordPress core's version of the block.

The video explains how to allow file types that can't be uploaded using other methods. In my case 'zip' is already supported. I use the upload from the Media Library.

@annezazu. Please re-open the issue until an explanation has been found. I don't believe I have the authority to re-open the issue.

[bobbingwide]

In the editor, when I view source, the allowedMimeTypes supports zip as application/zip

( function() {
--
  | window._wpLoadBlockEditor = new Promise( function( resolve ) {
  | wp.domReady( function() {
  | resolve( wp.editPost.initializeEditor( 'editor', "post", 359, {"alignWide":true,"availableTemplates":{"":"Default template","templates\/template-cover.php":"Cover Template","templates\/template-full-width.php":"Full Width Template"},"allowedBlockTypes":true,"disableCustomColors":false,"disableCustomFontSizes":false,"disableCustomGradients":false,"disablePostFormats":true,"titlePlaceholder":"Add title","bodyPlaceholder":"Start writing or type \/ to choose a block","isRTL":false,"autosaveInterval":60,"maxUploadFileSize":26214400,"allowedMimeTypes":{"jpg\|jpeg\|jpe":"image\/jpeg","gif":"image\/gif","png":"image\/png","bmp":"image\/bmp","tiff\|tif":"image\/tiff","ico":"image\/x-icon",

...

,"csv":"text\/csv","tsv":"text\/tab-separated-values","ics":"text\/calendar","rtx":"text\/richtext","css":"text\/css","htm\|html":"text\/html",
...

,"js":"application\/javascript","pdf":"application\/pdf","class":"application\/java","tar":"application\/x-tar","zip":"application\/zip","gz\|gzip":"application\/x-gzip","rar":"application\/rar","7z":" 

etc..

The zip entry is the last one listed when I view wp.data.select('core/editor').getEditorSettings().allowedMimeTypes in the console.

I don't have a problem uploading a .gz file

[bobbingwide]

I've made some progress attempting to debug the problem.
It would appear that the value of mediaFile.type is application/x-zip-compressed, but in my development machine mime_content_type returns application/zip.

A Google search indicates I'm not the first person to suffer this problem.

[bobbingwide]

I tried hacking core ( wp-includes/functions.php ) to add

'xzip'                           => 'application/x-zip-compressed',` 

to the array in wp_get_mime_types().

And it worked.
I needed to change the key from zip to xzip to allow both application/zip and `application/x-zip-compressed'.
Both end up as .zip files in the server.

So my guess is it's Gutenberg revealing a previously unhandled limitation of WordPress core.

I've found a TRAC that reports the problem similarly.
Now I've debugged the problem, I've found a relevant WordPress TRAC: https://core.trac.wordpress.org/ticket/46775

[bobbingwide]

See also https://core.trac.wordpress.org/ticket/40175

[annezazu]

@bobbingwide thanks for following up here with more information :) I've reopened and will add the label for needs-testing so someone else can try to replicate the issue at hand. Can you confirm you've tested this with Gutenberg 8.4 as well?

[bobbingwide]

Can you confirm you've tested this with Gutenberg 8.4 as well?

Tested with Gutenberg 8.4.0 as well.
The problem occurs with Windows machines. What were you using?

In my opinion the most sensible fix would be in WordPress core. See TRAC 40175.
It's also possible that Gutenberg could be changed to allow the upload to proceed for any mediaFile.type that it doesn't recognise and rely on the server being responsible for rejecting it.

[annezazu]

@bobbingwide circling back on this -- I've changed this from needs testing to a Core Bug as I agree that this would be best fixed by the trac issue you referenced. Thanks so much for your thorough reporting and digging in ❤️. I learned something new just following along!

[zdenys]

Gutenberg 8.7 on WP 5.4.2	WP 5.4.2 with Gutenberg turned off
https://d.pr/i/M09uJE	https://d.pr/i/ZNiNdH
I can reproduce with Gutenberg 8.7 on WP 5.4.2 and it happens for .png, .jpeg, .pdf, .csv and possibly all other type of files.	With Gutenberg plugin turned off I cannot reproduce on WP 5.4.2

[javidalkaruzi]

@zdenys pull request #24318 addressed the issues with uploading files, however, this specific issue where uploading was not permitted for security reasons, as stated in the error message, was not tested.

[ockham]

From my testing, it seems like #24318 fixed this indeed. (Specifically, I can repro the bug with 8.7, but not with 8.7.1, which includes only #24318, and another unrelated PR on top of 8.7.)

[pwkip]

Doesn't look like it's solved. Both with and without the Gutenberg plugin (8.8.0) installed, I get the same error while on windows.
When I try to do this from Linux, all works fine.

[bobbingwide]

circling back on this -- I've changed this from needs testing to a Core Bug as I agree that this would be best fixed by the trac issue you referenced.

Doesn't look like it's solved. Both with and without the Gutenberg plugin (8.8.0) installed, I get the same error while on windows.

In my opinion the most sensible fix would be in WordPress core. See TRAC 40175.
It's also possible that Gutenberg could be changed to allow the upload to proceed for any mediaFile.type that it doesn't recognise and rely on the server being responsible for rejecting it.

The problem hasn't been addressed in Gutenberg 8.9.1 nor has it been fixed in WordPress core.

This issue should be re-opened while the problem still occurs.

[timotheemoulin]

The error is still occurring with the latest WP version 5.5.1 (native Gutenberg).

[noahtallen]

Reopening. It sounds like this is a windows-specific issue?

[pwkip]

yes, i can confirm it happens on Windows in any browser, but not on Linux. (Didn't test on mac)

[jnz31]

my client is having the same issue (native gb, wp 5.5.3). i work on a mac, no issues, but he is most certainly on a windows machine and issued, that he cannot upload zip files. i thought it was a role issue (me admin, him editor), but testing this on my machine with role editor: no problems.

[MethylBromide]

I came here to report the same problem and found this existing report.

I created a new blank site to reproduce the issue.

• WordPress 5.6
• Siteground.com shared server
• Theme: Twenty Twenty-One, Version 1.0
• No plugins
• No settings changed

[pansamolot]

Hello. Do we have any progress here or a possible solution or workaround? Newly risen tickets (like mine #33187) are being closed linking to this one. But I see nothing happening here for past 8 months. The core report here suggests / claims that this is WP Core problem, but linked Trac ticket is not touched for past 4 months.

Am I missing something or does this mean that this problem is unsolved for four / half a year and there is nothing we can do to enable .zip uploading to Wordpress through File block?

[WXZhao7]

I have the similar problem.
I can upload all formats in the media library by adding define( 'ALLOW_UNFILTERED_UPLOADS', true); in wp-config.
I can upload some archived types such as .zip/.tar in file block, but I can't upload tarball file as .tgz.
I install 'File Upload Types by WPForms' to deal with other formats, but it does not work in file block.

WP 5.7.2

• wp-config
  
• File upload types
  
• upload test
  

[rjcalifornia]

This can be easily solved with something like this:

https://github.com/rjcalifornia/fixzip_upload

[pansamolot]

@rjcalifornia Thanks for your support and the development of a "fix" plugin. But rather than installing another plugin, I'd like to see this added to Wordpress / Gutenberg since this is a pure bug (I don't think that plugins are meant to fix plugins).

Any chance you can participate in writing a pull-request to any of corresponding tickets / report to get this solved in core code?

[rjcalifornia]

@rjcalifornia Thanks for your support and the development of a "fix" plugin. But rather than installing another plugin, I'd like to see this added to Wordpress / Gutenberg since this is a pure bug (I don't think that plugins are meant to fix plugins).

I agree.

Any chance you can participate in writing a pull-request to any of corresponding tickets / report to get this solved in core code?

Sure, I'll submit one and hopefully it will be in the next release.

[vijayhardaha]

This can be easily solved with something like this:

https://github.com/rjcalifornia/fixzip_upload

I suggested your plugin to a user in this WP forum https://wordpress.org/support/topic/uploading-file-not-working-zip-rar/#post-15470118
He confirms that it works fine.

[unicalus]

I want to upload zip files and for me not helped: WP Add Mime Types and File Upload Types by WPForms plugins. Not helped adding line to wp-config: define('ALLOW_UNFILTERED_UPLOADS', true);

But Helped: https://github.com/rjcalifornia/fixzip_upload

[elico]

Is there any solution in the block editor of 6.3.x?

[xlthlx]

I have a similar problem with swf files with WordPress 6.3.2: uploading from the Media Library, no issues, with the File block, no joy. I've tried all the suggestions above and more, but nothing works.